Revert "[优化] 添加基本鉴权支持，更新相关逻辑以生成 htpasswd 文件"

This reverts commit c9a532db65.
2026-10-01 22:46:38 +08:00 · 2026-05-26 10:57:21 +08:00
parent c9a532db65
commit 46fb1a2b79
7 changed files with 29 additions and 112 deletions
@@ -240,8 +240,6 @@ func filterAgentSupportFiles(files []SupportFile) []SupportFile {
 		switch {
 		case strings.HasSuffix(path, ".crt"), strings.HasSuffix(path, ".key"), strings.HasSuffix(path, ".pem"):
 			filtered = append(filtered, file)
-		case strings.HasSuffix(path, ".htpasswd"):
-			filtered = append(filtered, file)
 		case path == "pow_config.json":
 			filtered = append(filtered, file)
 		}
@@ -43,41 +43,6 @@ func TestGetActiveConfigForAgentIncludesPoWConfig(t *testing.T) {
 	}
 }

-func TestGetActiveConfigForAgentIncludesBasicAuthFile(t *testing.T) {
-	setupServiceTestDB(t)
-
-	_, err := CreateProxyRoute(ProxyRouteInput{
-		Domain:            "basic-agent.example.com",
-		OriginURL:         "https://origin.internal",
-		Enabled:           true,
-		BasicAuthEnabled:  true,
-		BasicAuthUsername: "admin",
-		BasicAuthPassword: "123",
-	})
-	if err != nil {
-		t.Fatalf("CreateProxyRoute failed: %v", err)
-	}
-
-	if _, err := PublishConfigVersion("root", false); err != nil {
-		t.Fatalf("PublishConfigVersion failed: %v", err)
-	}
-
-	activeConfig, err := GetActiveConfigForAgent()
-	if err != nil {
-		t.Fatalf("GetActiveConfigForAgent failed: %v", err)
-	}
-
-	for _, file := range activeConfig.SupportFiles {
-		if file.Path == "basic_auth/backend_basic_agent_example_com_1.htpasswd" {
-			if file.Content != "admin:{PLAIN}123\n" {
-				t.Fatalf("unexpected basic auth file content: %q", file.Content)
-			}
-			return
-		}
-	}
-	t.Fatal("expected agent config to include basic auth htpasswd support file")
-}
-
 func TestGetActiveConfigForAgentUsesTenMinutePoWSessionDefault(t *testing.T) {
 	setupServiceTestDB(t)

@@ -2,6 +2,7 @@ package service

 import (
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
@@ -174,8 +175,6 @@ const (
 	nginxObservabilityPortPlaceholder   = "__OPENFLARE_OBSERVABILITY_PORT__"
 )

-const basicAuthSupportDir = "basic_auth"
-
 var requiredMainConfigTemplatePlaceholders = []string{
 	"{{OpenRestyWorkerProcesses}}",
 	"{{OpenRestyWorkerConnections}}",
@@ -937,19 +936,11 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 			LimitRate:          route.LimitRate,
 		}
 		upstreamConfig := buildRouteUpstreamConfig(route, upstreams)
-		basicAuthFilePath := ""
-		if route.BasicAuthEnabled {
-			basicAuthFilePath = buildBasicAuthSupportFilePath(route)
-			supportFiles = append(supportFiles, SupportFile{
-				Path:    basicAuthFilePath,
-				Content: renderBasicAuthSupportFile(route.BasicAuthUsername, route.BasicAuthPassword),
-			})
-		}
 		if upstreamConfig.UsesNamedUpstream {
 			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
 		}
 		if !route.EnableHTTPS {
-			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, basicAuthFilePath, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, cfg))
 			continue
 		}
 		certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
@@ -1010,7 +1001,7 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)

 		if route.RedirectHTTP {
 			if len(httpOnlyDomains) > 0 {
-				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, basicAuthFilePath, cfg))
+				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, cfg))
 			}
 			for _, certID := range certIDs {
 				assignedDomains := domainsByCertID[certID]
@@ -1020,14 +1011,14 @@ func renderRouteConfig(routes []*model.ProxyRoute, cfg openRestyConfigSnapshot)
 				builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
 			}
 		} else {
-			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, basicAuthFilePath, cfg))
+			builder.WriteString(renderHTTPProxyServer(serverNames, route.OriginURL, route.OriginHost, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, cfg))
 		}
 		for _, certID := range certIDs {
 			assignedDomains := domainsByCertID[certID]
 			if len(assignedDomains) == 0 {
 				continue
 			}
-			builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), route.OriginURL, route.OriginHost, certID, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, basicAuthFilePath, cfg))
+			builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), route.OriginURL, route.OriginHost, certID, customHeaders, cacheConfig, limitConfig, upstreamConfig, route.PoWEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, cfg))
 		}
 	}
 	return builder.String(), dedupeSupportFiles(supportFiles), nil
@@ -1143,15 +1134,20 @@ func renderPowAccessBlock(powEnabled bool) string {
 	return fmt.Sprintf("    access_by_lua_file %s/pow/check.lua;\n", nginxLuaDirPlaceholder)
 }

-func renderBasicAuthBlock(filePath string) string {
-	if strings.TrimSpace(filePath) == "" {
+func renderBasicAuthBlock(enabled bool, username, password string) string {
+	if !enabled || username == "" || password == "" {
 		return ""
 	}
-	return fmt.Sprintf("        auth_basic \"Restricted\";\n        auth_basic_user_file %s/%s;\n", nginxCertDirPlaceholder, filePath)
-}
-
-func renderBasicAuthSupportFile(username, password string) string {
-	return fmt.Sprintf("%s:{PLAIN}%s\n", username, password)
+	credentials := username + ":" + password
+	encoded := base64.StdEncoding.EncodeToString([]byte(credentials))
+	return fmt.Sprintf(`        rewrite_by_lua_block {
+            local auth = ngx.var.http_authorization
+            if auth ~= "Basic %s" then
+                ngx.header["WWW-Authenticate"] = 'Basic realm="Restricted"'
+                return ngx.exit(401)
+            end
+        }
+`, encoded)
 }

 func renderPowLocationBlocks(powEnabled bool) string {
@@ -1281,21 +1277,21 @@ func nextVersionNumber(now time.Time) (string, error) {
 	return fmt.Sprintf("%s-%03d", prefix, count+1), nil
 }

-func renderHTTPProxyServer(serverNames string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthFilePath string, cfg openRestyConfigSnapshot) string {
-	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthFilePath), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+func renderHTTPProxyServer(serverNames string, originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg openRestyConfigSnapshot) string {
+	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }

 func renderHTTPRedirectServer(serverNames string) string {
 	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
 }

-func renderHTTPSServer(serverNames string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthFilePath string, cfg openRestyConfigSnapshot) string {
+func renderHTTPSServer(serverNames string, originURL string, originHost string, certificateID uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg openRestyConfigSnapshot) string {
 	certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
 	keyPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateKeyFileName(certificateID))
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certPath, keyPath, renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthFilePath), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certPath, keyPath, renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }

-func renderHTTPSServerWithCertificates(serverNames string, originURL string, originHost string, certificateIDs []uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthFilePath string, cfg openRestyConfigSnapshot) string {
+func renderHTTPSServerWithCertificates(serverNames string, originURL string, originHost string, certificateIDs []uint, customHeaders []ProxyRouteCustomHeaderInput, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg openRestyConfigSnapshot) string {
 	var certificateBlock strings.Builder
 	for _, certificateID := range certificateIDs {
 		certPath := fmt.Sprintf("%s/%s", nginxCertDirPlaceholder, certificateCertFileName(certificateID))
@@ -1303,7 +1299,7 @@ func renderHTTPSServerWithCertificates(serverNames string, originURL string, ori
 		certificateBlock.WriteString(fmt.Sprintf("    ssl_certificate %s;\n", certPath))
 		certificateBlock.WriteString(fmt.Sprintf("    ssl_certificate_key %s;\n", keyPath))
 	}
-	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n%s%s%s\n    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certificateBlock.String(), renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthFilePath), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
+	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n%s%s%s\n    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certificateBlock.String(), renderPowAccessBlock(powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
 }

 func renderServerNames(domains []string) string {
@@ -1595,10 +1591,6 @@ func buildRouteUpstreamName(route *model.ProxyRoute) string {
 	return fmt.Sprintf("backend_%s_%d", sanitized, route.ID)
 }

-func buildBasicAuthSupportFilePath(route *model.ProxyRoute) string {
-	return fmt.Sprintf("%s/%s.htpasswd", basicAuthSupportDir, buildRouteUpstreamName(route))
-}
-
 func renderNamedUpstreamBlock(upstreamConfig routeUpstreamConfig) string {
 	var builder strings.Builder
 	builder.WriteString(fmt.Sprintf("upstream %s {\n", upstreamConfig.Name))
@@ -1060,14 +1060,11 @@ func TestPublishConfigVersionRendersBasicAuthWithPoW(t *testing.T) {
 	if err != nil {
 		t.Fatalf("PublishConfigVersion failed: %v", err)
 	}
-	if strings.Contains(result.Version.RenderedConfig, "rewrite_by_lua_block") {
-		t.Fatal("expected basic auth to use native nginx auth_basic instead of lua authorization checks")
+	if !strings.Contains(result.Version.RenderedConfig, `if auth ~= "Basic YWRtaW46MTIz" then`) {
+		t.Fatal("expected rendered config to include encoded basic auth credentials")
 	}
-	if !strings.Contains(result.Version.RenderedConfig, `auth_basic "Restricted";`) {
-		t.Fatal("expected rendered config to enable native basic auth")
-	}
-	if !strings.Contains(result.Version.RenderedConfig, "auth_basic_user_file __OPENFLARE_CERT_DIR__/basic_auth/backend_xbot_example_com_1.htpasswd;") {
-		t.Fatal("expected rendered config to reference managed htpasswd file")
+	if !strings.Contains(result.Version.RenderedConfig, "                return ngx.exit(401)\n            end\n        }\n") {
+		t.Fatal("expected rendered basic auth Lua block to close the if statement before the nginx block")
 	}
 	if !strings.Contains(result.Version.RenderedConfig, "    access_by_lua_file __OPENFLARE_LUA_DIR__/pow/check.lua;") {
 		t.Fatal("expected PoW access handler to remain at server scope")
@@ -1084,23 +1081,6 @@ func TestPublishConfigVersionRendersBasicAuthWithPoW(t *testing.T) {
 	if !strings.Contains(result.Version.SnapshotJSON, `"basic_auth_password":"123"`) {
 		t.Fatal("expected snapshot to include basic auth password")
 	}
-	var supportFiles []SupportFile
-	if err := json.Unmarshal([]byte(result.Version.SupportFilesJSON), &supportFiles); err != nil {
-		t.Fatalf("failed to decode support files: %v", err)
-	}
-	foundBasicAuthFile := false
-	for _, file := range supportFiles {
-		if file.Path != "basic_auth/backend_xbot_example_com_1.htpasswd" {
-			continue
-		}
-		foundBasicAuthFile = true
-		if file.Content != "admin:{PLAIN}123\n" {
-			t.Fatalf("unexpected basic auth support file content: %q", file.Content)
-		}
-	}
-	if !foundBasicAuthFile {
-		t.Fatal("expected publish to include basic auth htpasswd support file")
-	}
 }

 func TestDiffConfigVersionDetectsBasicAuthChanges(t *testing.T) {
@@ -271,12 +271,6 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		if input.BasicAuthUsername == "" || input.BasicAuthPassword == "" {
 			return nil, errors.New("basic_auth_username and basic_auth_password cannot be empty when basic auth is enabled")
 		}
-		if strings.ContainsAny(input.BasicAuthUsername, ":\r\n") {
-			return nil, errors.New("basic_auth_username cannot contain colon or newline")
-		}
-		if strings.ContainsAny(input.BasicAuthPassword, "\r\n") {
-			return nil, errors.New("basic_auth_password cannot contain newline")
-		}
 	} else {
 		input.BasicAuthUsername = ""
 		input.BasicAuthPassword = ""